Simplify multi-arch publish and verify both index and manifest cases

--all on the existing oci-archive: transport is sufficient to publish
the full multi-arch index; the tar/oci: directory extraction isn't
needed. Also fix the verification so it doesn't silently pass for the
single-arch precompiled builds (ubuntu22.04, ubuntu26.04, and
ubuntu24.04 azure-fde all build amd64-only per multi-arch.mk) by
comparing manifest digests structurally instead of an empty
manifests[] list against another empty list.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>

Author: abrarshivani

.github/workflows/precompiled.yaml

@@ -495,16 +495,35 @@ jobs:
           IMAGE="${PRIVATE_REGISTRY}/nvidia/driver:${{ matrix.driver_branch }}-${{ env.KERNEL_VERSION }}"
           echo "uploading  $image_path"
           if [[ "${{ github.ref == 'refs/heads/main' }}" == "true" ]]; then
-            mkdir -p /tmp/oci-image
-            tar -xf "${image_path}" -C /tmp/oci-image
-            skopeo copy --all --authfile "${REGISTRY_AUTH_FILE}" "oci:/tmp/oci-image" docker://${IMAGE}
-
-            # Verify published manifest matches the built OCI artifact by comparing
-            # platform digests — ensures skopeo copy pushed all manifests correctly
-            LOCAL=$(skopeo inspect --raw "oci:/tmp/oci-image" | \
-              jq -c '[.manifests[]? | {arch: .platform.architecture, digest: .digest}] | sort_by(.arch)')
-            REMOTE=$(skopeo inspect --raw "docker://${IMAGE}" | \
-              jq -c '[.manifests[]? | {arch: .platform.architecture, digest: .digest}] | sort_by(.arch)')
+            skopeo copy --all --authfile "${REGISTRY_AUTH_FILE}" "oci-archive:${image_path}" "docker://${IMAGE}"
+
+            # Verify the registry actually holds what we built — skopeo copy can
+            # succeed while silently publishing an incomplete result (missing --all
+            # drops non-native-arch manifests without erroring), so compare the
+            # published manifest against the local artifact rather than trusting
+            # the exit code alone. Index and single-arch images need different
+            # comparisons: an index has no useful top-level digest of its own, so
+            # we compare per-platform digests instead; a plain manifest has no
+            # platform list, so we compare its config/layer digests directly.
+            LOCAL_RAW=$(skopeo inspect --raw "oci-archive:${image_path}")
+            REMOTE_RAW=$(skopeo inspect --raw --authfile "${REGISTRY_AUTH_FILE}" "docker://${IMAGE}")
+
+            if echo "$LOCAL_RAW" | jq -e '.manifests' >/dev/null 2>&1; then
+              # Multi-arch index: compare platform+digest pairs. Attestation
+              # manifests (no real platform, arch reported as "unknown") are
+              # excluded so they don't pad out an otherwise-empty comparison.
+              JQ_FILTER='[.manifests[] | select(.platform.architecture and .platform.architecture != "unknown") | {arch: .platform.architecture, digest: .digest}] | sort_by(.arch)'
+              LOCAL=$(echo "$LOCAL_RAW" | jq -c "$JQ_FILTER")
+              REMOTE=$(echo "$REMOTE_RAW" | jq -c "$JQ_FILTER")
+            else
+              # Single-arch manifest: compare config + layer digests structurally
+              # rather than raw bytes, since the registry may re-serialize the
+              # manifest on push without changing its actual content.
+              JQ_FILTER='{config: .config.digest, layers: [.layers[].digest]}'
+              LOCAL=$(echo "$LOCAL_RAW" | jq -c "$JQ_FILTER")
+              REMOTE=$(echo "$REMOTE_RAW" | jq -c "$JQ_FILTER")
+            fi
+
             if [[ "$LOCAL" == "$REMOTE" ]]; then
               echo "OK: published manifest matches built artifact"
             else
@@ -513,8 +532,6 @@ jobs:
               echo "Remote: $REMOTE"
               exit 1
             fi
-
-            rm -rf /tmp/oci-image
           else
             echo "Skipping image push for non-main branch ${{ github.ref }}"
           fi